diff --git a/.changeset/eight-plums-hide.md b/.changeset/eight-plums-hide.md
new file mode 100644
index 0000000000..bf34b7ee63
--- /dev/null
+++ b/.changeset/eight-plums-hide.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend': patch
+---
+
+Forward user token to scaffolder taskworker for subsequent api requests
diff --git a/plugins/scaffolder-backend/src/scaffolder/actions/types.ts b/plugins/scaffolder-backend/src/scaffolder/actions/types.ts
index 955cb72de9..fbe18b848e 100644
--- a/plugins/scaffolder-backend/src/scaffolder/actions/types.ts
+++ b/plugins/scaffolder-backend/src/scaffolder/actions/types.ts
@@ -32,6 +32,10 @@ export type ActionContext<Input extends InputBase> = {
   logger: Logger;
   logStream: Writable;
 
+  /**
+   * User token forwarded from initial request, for use in subsequent api requests
+   */
+  token?: string | undefined;
   workspacePath: string;
   input: Input;
   output(name: string, value: JsonValue): void;
diff --git a/plugins/scaffolder-backend/src/scaffolder/tasks/TaskWorker.ts b/plugins/scaffolder-backend/src/scaffolder/tasks/TaskWorker.ts
index 3a846f79a5..a6c97027d2 100644
--- a/plugins/scaffolder-backend/src/scaffolder/tasks/TaskWorker.ts
+++ b/plugins/scaffolder-backend/src/scaffolder/tasks/TaskWorker.ts
@@ -134,6 +134,7 @@ export class TaskWorker {
             logger: taskLogger,
             logStream: stream,
             input,
+            token: task.spec.token,
             workspacePath,
             async createTemporaryDirectory() {
               const tmpDir = await fs.mkdtemp(
diff --git a/plugins/scaffolder-backend/src/scaffolder/tasks/types.ts b/plugins/scaffolder-backend/src/scaffolder/tasks/types.ts
index 6963817a1e..a5affc418d 100644
--- a/plugins/scaffolder-backend/src/scaffolder/tasks/types.ts
+++ b/plugins/scaffolder-backend/src/scaffolder/tasks/types.ts
@@ -44,6 +44,7 @@ export type DbTaskEventRow = {
 
 export type TaskSpec = {
   baseUrl?: string;
+  token?: string | undefined;
   values: JsonObject;
   steps: Array<{
     id: string;
diff --git a/plugins/scaffolder-backend/src/service/router.ts b/plugins/scaffolder-backend/src/service/router.ts
index 1e2891cfb8..c5f42edd76 100644
--- a/plugins/scaffolder-backend/src/service/router.ts
+++ b/plugins/scaffolder-backend/src/service/router.ts
@@ -358,8 +358,9 @@ export async function createRouter(
     .post('/v2/tasks', async (req, res) => {
       const templateName: string = req.body.templateName;
       const values: TemplaterValues = req.body.values;
+      const token = getBearerToken(req.headers.authorization);
       const template = await entityClient.findTemplate(templateName, {
-        token: getBearerToken(req.headers.authorization),
+        token,
       });
 
       let taskSpec;
@@ -386,6 +387,7 @@ export async function createRouter(
 
         taskSpec = {
           baseUrl,
+          token,
           values,
           steps: template.spec.steps.map((step, index) => ({
             ...step,
@@ -412,6 +414,8 @@ export async function createRouter(
       if (!task) {
         throw new NotFoundError(`Task with id ${taskId} does not exist`);
       }
+      // Do not disclose token
+      delete task.spec.token;
       res.status(200).json(task);
     })
     .get('/v2/tasks/:taskId/eventstream', async (req, res) => {